AI Agents Weaponized In Microsoft Attack

Microsoft has detailed a significant security incident where a China-aligned group, identified as Storm-0940, utilized an artificial intelligence framework to orchestrate a large-scale attack through a breach in ConnectWise's systems. According to a post on the company's Security blog, the operation involved unauthorized access to a multi-tenant application, which was then used to attempt sign-ins across more than 2,250 Microsoft 365 tenants. The attackers leveraged stolen application credentials, allowing them to authenticate without requiring a user's login.

The timeline of the assault reveals the alarming efficiency of the tools involved. Storm-0940, an active threat actor since 2021, initiated targeting efforts on October 11. By October 15, the activity had escalated to the point where one system was compromised. By the following day, October 16, security firm Huntress confirmed unauthorized sign-ins for 162 tenants, and by October 17, nearly 1,000 Entra tenants showed sign-in activity from the attackers' IP address.

Central to the breach was the deployment of ARTEX, an open-source agentic AI penetration testing framework. Microsoft describes ARTEX as a system of LLM-driven agents capable of running autonomous penetration tests. These agents can operate around the clock with minimal human oversight, performing tasks such as scanning, reconnaissance, password spraying, and OAuth application abuse at a pace that leaves defenders with little time to detect and respond. Microsoft noted that in some instances, the attackers reached privileged access in under three hours after initial targeting.

While the AI agents were conducting reconnaissance, a separate automated password spraying campaign targeted 327 accounts across eight organizations, generating over 151,000 failed login attempts without a single success. However, the primary threat came from the AI-driven intrusion. By controlling application identities, the agents signed into customer tenants from a single IP range. On October 11, at the campaign's peak, this activity involved 2,900 attempts per minute.

The consequences of the attack are tangible. Security firm Huntress observed instances where malicious apps were added to top administrator roles, effectively granting them Global Administrator status. In one case, new secrets were planted with an expiration date set for 2028. The pattern of access, moving through tenants in a sorted sequence just seconds apart, indicated the use of a script operating from a pre-determined target list.

In response to the breach, ConnectWise has suspended several of its services as a precautionary measure, including Cloud Backup, SaaS Security, and Cloud Management. A phased restoration process has begun and is expected to take several days. The company has stated that it has no indicators to suggest that partner backup data was compromised.

Microsoft advises that customers whose app connections were affected should keep them disabled until formal restoration instructions are provided. The company also recommends reviewing activity logs for this month to identify any potential issues. It is important to note that an affected app or even a successful sign-in does not necessarily mean that data was accessed or stolen.